AI Vendor Directory · AI in productivity suites
Does Salesforce Einstein / Agentforce train on your data?
No — does not train on your data by default. Vendor-stated default: no (all tiers; any future training would require explicit opt-in). Salesforce's Agentforce Privacy FAQ: 'Salesforce does not currently use Customer Data to train generative AI models,' and if that ever changes the applicable Product Terms 'expressly require Customers to opt-in to such training.' For third-party LLMs (OpenAI direct, or Anthropic/OpenAI hosted on AWS/Azure): 'Salesforce operates a zero data retention policy which ensures no Customer Data is retained or used for model training by third-party LLMs.' Customer Data is not stored in Agentforce itself (stored in the underlying Salesforce services). Two caveats: the FAQ does not cover BYO-LLM (your own model contract governs), and data masking in the Einstein Trust Layer is currently disabled for Agentforce by default — review before processing sensitive data.
By the Shieldra Compliance Team · Last updated 2026-07-29
What is Salesforce Einstein / Agentforce?
Agentforce is Salesforce's platform for autonomous AI agents (service, sales, SDR) on top of the CRM, built on the Einstein Trust Layer; Einstein covers the platform's embedded generative/predictive AI.
Key facts
- Vendor: Salesforce — https://www.salesforce.com/agentforce/
- Trains on customer data by default: no (all tiers; any future training would require explicit opt-in)
- Source for the training answer: https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Privacy/agentforce-privacy-FAQ.pdf
- Last verified: 2026-07-29
What certifications does Salesforce Einstein / Agentforce hold?
- SOC 2 Type II
- ISO 27001
- PCI DSS
- HIPAA
- IRAP
- FedRAMP High
Security, DPA, and subprocessor links
- Security / trust page: https://compliance.salesforce.com/en
- Data processing agreement (DPA): https://www.salesforce.com/company/legal/agreements/
- Subprocessor list: https://www.salesforce.com/company/legal/agreements/
What is your EU AI Act role when you build on Salesforce Einstein / Agentforce?
Deployer; customer-facing Agentforce agents trigger Article 50 — end users must be informed they are interacting with AI (configure agent disclosures). Building custom agents on the platform for third parties can shift you toward provider obligations.
What to record in your AI registry
- Provider: Salesforce
- Model type: third party api
- Data typically flowing to the vendor: CRM records and customer PII, agent conversation transcripts, Data Cloud grounding data, case/opportunity data
Sources
- https://www.salesforce.com/en-us/wp-content/uploads/sites/4/documents/legal/Privacy/agentforce-privacy-FAQ.pdf
- https://developer.salesforce.com/docs/ai/agentforce/guide/trust.html
- https://compliance.salesforce.com/en
- https://www.salesforce.com/company/legal/agreements/
Disclaimer
Curated from vendor-published pages on the date above. Vendor terms change - verify against the cited sources before relying on a profile for a procurement decision. Last verified 2026-07-29.
Frequently asked questions
Does Salesforce Einstein / Agentforce train AI models on your data?
No — does not train on your data by default. Vendor-stated default: no (all tiers; any future training would require explicit opt-in). Salesforce's Agentforce Privacy FAQ: 'Salesforce does not currently use Customer Data to train generative AI models,' and if that ever changes the applicable Product Terms 'expressly require Customers to opt-in to such training.' For third-party LLMs (OpenAI direct, or Anthropic/OpenAI hosted on AWS/Azure): 'Salesforce operates a zero data retention policy which ensures no Customer Data is retained or used for model training by third-party LLMs.' Customer Data is not stored in Agentforce itself (stored in the underlying Salesforce services). Two caveats: the FAQ does not cover BYO-LLM (your own model contract governs), and data masking in the Einstein Trust Layer is currently disabled for Agentforce by default — review before processing sensitive data.
What certifications does Salesforce Einstein / Agentforce hold?
Per the vendor's published pages as of 2026-07-29: SOC 2 Type II; ISO 27001; PCI DSS; HIPAA; IRAP; FedRAMP High.
What is your EU AI Act role when you build on Salesforce Einstein / Agentforce?
Deployer; customer-facing Agentforce agents trigger Article 50 — end users must be informed they are interacting with AI (configure agent disclosures). Building custom agents on the platform for third parties can shift you toward provider obligations.
